High severity7.4NVD Advisory· Published Sep 6, 2026· Updated Sep 15, 2026

CVE-2026-13608

Description

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Curl/Libcurlllm-fuzzy
osv-coords2 versions
pkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/curl&distro=openSUSE%20Tumbleweed
< 8.14.1-160000.9.1+ 1 more
- (no CPE)range: < 8.14.1-160000.9.1
- (no CPE)range: < 8.22.0-1.1

Patches

Vulnerability mechanics

References

curl.se/docs/CVE-2026-13608.htmlnvdPatchVendor Advisory
hackerone.com/reports/3822248nvdExploitThird Party Advisory
curl.se/docs/CVE-2026-13608.jsonnvdVendor Advisory

News mentions

3 lessons from frontier AI vulnerability research
Microsoft Security Blog · Oct 7, 2026
Patch Tuesday - September 2026
Rapid7 Blog · Sep 8, 2026

cvss	0.481
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000